Privacy Policy

Last updated: 15 September 2026

FreeReach AI ("FreeReach", "we", "us") is a multi-tenant software-as-a-service platform that helps businesses discover free opportunities to earn website traffic, brand exposure and backlinks. This policy explains what personal data and third-party account data we process, why we process it, and the choices you have. It applies to every customer account (each a "tenant") and to every business profile created inside an account.

Who is responsible for your data

FreeReach AI is the data controller for the account information you give us and the data our platform generates for you. If you use FreeReach on behalf of an organisation, that organisation is responsible for the business data it enters and for who it invites into its account. Contact us at privacy@freereach.ai for any privacy request.

What we collect

Account data — your name, email address and a securely hashed password, or the basic profile (name, email, profile picture) supplied by your chosen social sign-in provider.
Business profile data — the business name, website, target countries, products, brands, competitors and keywords you enter so we can find relevant opportunities.
Platform data — discovered opportunities, scores, AI-generated drafts, published outcomes (including the published URL and date you record), tracking links and their click counts.
Technical data — log data such as IP address, browser type, request times and error traces, used for security and troubleshooting.
Connected third-party data — where you choose to connect an external account, the specific data described in "Google account and Search Console access" below.

We do not sell personal data, we do not use your data to build advertising profiles, and we do not require payment card details to be stored with us (payments, when enabled, are handled by our payment provider).

Google account and Search Console access (read-only)

Connecting Google Search Console is entirely optional and is requested per business profile, not per user. If you connect it, FreeReach uses Google OAuth 2.0 and requests the minimum scopes needed:

webmasters.readonly — read-only access to the Search Console properties the authorising Google account can already access. FreeReach cannot add, change, verify or delete properties, cannot submit or remove URLs, and cannot modify anything in your Google account or on your website.
openid and userinfo.email — the email address of the connected Google account, shown in the app so you can see which account is linked and so support can help you.

What we read. The list of Search Console properties available to that Google account (and your permission level), and Search performance metrics for the specific pages you have recorded as published in FreeReach: impressions, clicks, click-through rate, average position and the date, for the date ranges you request.

Why we read it. For one narrow purpose: to show you what Google Search performance a page you published through a FreeReach opportunity has actually generated. We do not read Search performance for pages unrelated to your recorded opportunities, we do not use this data to train models, and we never share, pool, aggregate across tenants or sell it.

How tokens are handled. We store only a Google refresh token, encrypted at rest, associated with the single business profile you connected. Access tokens are short-lived and held only in memory for the duration of a request. Tokens are never exposed to your browser, never written to logs and never shared with other tenants or third parties. Access is always scoped to the connecting business, so one tenant can never read another tenant's Google data.

How to disconnect. You can disconnect at any time from the business profile settings in FreeReach: this deletes the stored refresh token immediately. You can also revoke FreeReach's access directly in your Google Account at myaccount.google.com/permissions. After disconnecting, we stop requesting data; any performance figures already retrieved can be deleted on request, or by deleting the business profile.

FreeReach's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Why we process your data

To provide the service you asked for: discovering, scoring and acting on free traffic opportunities (performance of a contract).
To generate content drafts you request, using third-party AI providers (performance of a contract).
To secure the platform, prevent abuse and fix faults (legitimate interests).
To connect optional integrations such as Google Search Console (your consent, given per business at the point of connection).
To meet legal and accounting obligations (legal obligation).

Service providers we use

Cloud hosting and database — to run the application and store your data.
AI providers — content you ask us to generate is sent to large-language-model providers to produce the draft. Prompts contain your business profile details and the opportunity context; they are not used by us to train models.
Web search providers — used to discover public pages and opportunities.
Google — only where you have connected Search Console, as described above.

Each provider acts under contract and only on our instructions.

How long we keep data

Account and business data is retained while your account is active. Discovered opportunities, drafts, published outcomes and tracking data are kept so your history stays intact. Google Search performance rows are kept only for pages you recorded as published, and are deleted when you disconnect the integration and request deletion, or when the business profile is deleted. Deleting your account removes your tenant data from live systems, with routine backups expiring afterwards.

Your rights

Depending on where you live, you may ask us to access, correct, export or delete your personal data, to restrict or object to processing, or to withdraw consent for an optional integration. Email privacy@freereach.ai and we will respond within the period required by applicable law. You may also complain to your local data protection authority (in the UK, the Information Commissioner's Office).

Security

We use encrypted transport (HTTPS), hashed passwords, encryption at rest for integration tokens, tenant-scoped authorisation on every request and least-privilege access for our team. No system is perfectly secure, so please tell us immediately at security@freereach.ai if you suspect a problem.

Changes to this policy

If we change how we use your data we will update this page and, for material changes, tell you inside the app. Continuing to use FreeReach after a change means you accept the updated policy.